{
  "affected": [
    {
      "affectedData": [
        {
          "product": "WS318n-21",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.2.2"
            },
            {
              "status": "affected",
              "version": "10.0.2.5"
            },
            {
              "status": "affected",
              "version": "10.0.2.6"
            }
          ]
        }
      ],
      "source": "psirt@huawei.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "951E297A-36DB-4EA5-B011-CB2E7AE5E671",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E475C051-DE1A-4E4E-B0BB-AB900078B1CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0273D8BE-11C2-4CEC-A799-C2A4D9970472",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ws318n-21:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "96114840-BAF9-476B-AE8D-27DCB0977CDB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a local authenticated attacker could exploit this vulnerability by injecting special characters. Successful exploit could cause certain information disclosure. Affected product versions include: WS318n-21 10.0.2.2, 10.0.2.5 and 10.0.2.6."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de tipo Cross-Site Scripting(XSS) en el producto HUAWEI WS318n cuando son procesados los ajustes de red. Debido a una comprobaci\u00f3n de entrada insuficiente del usuario, un atacante local autenticado podr\u00eda explotar esta vulnerabilidad al inyectar caracteres especiales. Una explotaci\u00f3n con \u00e9xito podr\u00eda causar determinada divulgaci\u00f3n de informaci\u00f3n. Las versiones del producto afectadas son: WS318n-21 10.0.2.2, 10.0.2.5 y 10.0.2.6"
    }
  ],
  "id": "CVE-2021-40041",
  "lastModified": "2026-06-17T04:06:26.540",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 1.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-10T14:10:23.123",
  "references": [
    {
      "source": "psirt@huawei.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211229-01-xss-en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211229-01-xss-en"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}